Llama discovered an issue with the AIP-144 Swap Contract with respect to the aUST asset after the proposal was executed. There were ~$20k worth of funds at risk, which we whitehat-rescued. We also confirmed that this issue affected only aUST in the proposal scope and no other assets. Due to the rescue, Aave Protocol and Aave DAO will not bear any loss from this issue.
As part of AIP-144, Llama deployed a Swap contract that encouraged users to deposit USDC in order to receive certain long-tail assets along with a small premium from the Aave Ethereum v2 Collector Contract. This proposal was intended to consolidate the various Aave Treasury holdings into USDC.
Shortly after proposal execution, we noticed that a boolean value (
ethFeedOnly) was set incorrectly in the Swap Contract constructor for the aUST configuration. This caused the contract to treat USD as ETH, which meant an arbitrager could acquire approximately $20k worth of aUST (i.e.~892,451 aUST) for ~12 USDC.
A Llama contributor, @Dydymoon, found this issue and took a whitehat action of arbitraging the entire aUST amount in this specific transaction. We have returned the entire aUST amount to the Aave collector (test transaction, final transaction).
We have cross-checked all remaining assets and confirmed that they are configured with the correct
ethFeedOnly boolean value for their respective oracles. No other assets were affected.
The specific issue can be narrowed down to this boolean value being set to
false instead of
true at line 179 in the Swap Contract constructor.
That specific boolean (
ethFeedOnly) tells the contract whether the oracle being used is a USD-denominated feed or an ETH-denominated feed for a particular asset. In this case, the aUST Oracle that was used was an ETH feed. However, with that boolean set as
false, the contract assumed the oracle was a USD feed and didn’t execute this particular code block, which would have resulted in the appropriate price and decimal conversion from ETH to USD.
We will work on a separate proposal payload to swap the aUST from the Aave collector. Additionally, we will share a post-mortem that details how incorrect constructor configurations like this one will be prevented in the future.